On this page
What patient data does Tilcao touch, and what does it never touch?
Enough to recognise the caller and finish the booking, and deliberately nothing beyond that. Tilcao is an AI receptionist for dental practices, not a practice management system, and has no ambition to become one. It never writes in the clinical record, never reads a treatment history, and stays entirely out of the national rails Belgium runs through the RIZIV/INAMI, the national health and disability insurance institute, and MyCareNet.
The right-hand column matters more than the left one. Denying a capability is a stronger signal than claiming one, and every line in it is a place where a Belgian practice would otherwise have to take a vendor’s word.
- Before a practice’s first real patient call, the national register number (rijksregisternummer / numéro de registre national, the NISS) is redacted at ingestion and kept out of every retained transcript.
- Card numbers and full addresses are held to the same rule.
- So is the date of birth, which is stored as a date field rather than left sitting inside a retained transcript.
- Before a practice’s first real patient call, what is replicated to a dashboard becomes an appointment type code, not the caller’s account of a complaint, which stays in a separate note with its own access. Today the Tilcao team’s dashboard shows the full transcript.
- The integration account Tilcao works through holds the narrowest rights that do the job: read the diary, create and move appointments of the configured types, cancel. Nothing else.
| Tilcao processes this | Tilcao never touches this |
|---|---|
| Name, date of birth and contact details, to match a caller to a file | The clinical record. Nothing is written to it and no treatment history is read |
| The appointment itself: type, length, practitioner, date and time | eAttest, eFact and eTarif. Tilcao never attests and never invoices |
| What the caller said they were ringing about, in the caller’s own words | MyCareNet insurability checks and the GMD/DMG. Tilcao holds no eHealth certificate |
| The call audio and its transcript, each on its own retention clock | The eHealthBox and the rest of the eHealth rails. There is no connection to build on |
| A structured summary of what was asked and what was done | Payments. No card details are taken and no transaction is handled |
| The audit record of the call, and, once a practice is live, who read it afterwards | A diagnosis, an urgency judgement, or a tariff the practice did not give it |
Who is the controller, and what has to be signed before the first call?
The practice is the controller and Tilcao is the processor, the verwerker or sous-traitant, acting only on the practice’s written instructions. That is not a formality to tidy up later. An Article 28 processing agreement has to exist before the first real patient call, and until it does there should be no real patient call.
The legal ground has two layers, because a dental call has two kinds of content. The ordinary part, a name and a time in a diary, rests on Article 6(1)(b) and (f). The health element rests on Article 9(2)(h) for the provision of health care, read with Article 9(3), which requires the processing to happen under the responsibility of a professional bound by professional secrecy or by an equivalent duty of confidentiality. That second clause is the one that decides how Tilcao has to be run internally, and it is dealt with in the next section.
Consent is the wrong ground to lean on, and a vendor who offers it as the answer has not thought about the call. Consent is not freely given when a patient rings in pain and the alternative to agreeing is not getting care. So the disclosure is paired with a real alternative: anyone who would rather speak to a person says so and is handed over, or gets a callback when the practice is closed. Retention of the raw audio is the part a practice can decline without losing the service.
The agreement should be readable by the practice that signs it, not only by a lawyer. These are the clauses to check before signing anything, from Tilcao or from anyone else.
- The subject matter, the duration, and the categories of data and of data subjects.
- The documented instructions, and a commitment to process on nothing else.
- An annex naming every sub-processor, what it does and the region it processes in.
- A retention period per data type, written as a number of days or months.
- The security measures, and how a personal data breach is notified and within what time.
- How the processor helps with access, rectification and erasure requests.
- What happens at the end of the contract: return or deletion, and the evidence of it.
- The right to audit, and what an audit may actually look at.
SourceGegevensbeschermingsautoriteit / Autorité de protection des données, guidance on sensitive data
How does a recorded call sit with beroepsgeheim and secret professionnel?
Professional secrecy, beroepsgeheim in Dutch and secret professionnel in French, is a separate obligation from the GDPR, it survives the GDPR, and no processing agreement can sign it away. Article 352 of the Belgian Criminal Code (formerly Article 458) binds the dentist and, through the dentist, the people working at the practice. Breaching it is a criminal matter, not an administrative one. So the real question about a recorded call is not whether recording is lawful. It is who can hear the recording, under what duty, and whether that can be proved.
On the recording itself, Belgian law is clearer than most people expect. There is no rule forbidding the recording of a conversation you are party to, and the practice is a party to its own patient calls. Article 344 of the Belgian Criminal Code (formerly Article 314bis §2) punishes the use of a lawfully made recording with fraudulent intent or intent to harm. Telecom rules and the GDPR then apply on top, cumulatively: every participant, the patient included, has to be informed before the recording starts about the recording itself, its precise purpose, and how long it is kept. Tilcao’s opening line always gives the first, together with the AI disclosure, rather than burying it in a privacy notice nobody opens. It gives the purpose when the practice’s wording names it, as in “this call is recorded so your appointment is noted correctly”. The purpose and the retention period also go in the practice’s privacy notice, the period once it is set in the processing agreement.
Inside Tilcao, the Article 9(3) requirement rests on people rather than on a setting. Only those who need a transcript to run the service can read one. Before a practice’s first real patient call, each of them signs a written confidentiality undertaking that mirrors medical secrecy. From that call on, each read is logged against a named account, and the practice can ask for that log at any time. This carries particular weight for francophone practices: the Chambre de Médecine Dentaire names medical secrecy, alongside free choice of practitioner, as one of the two founding principles of the profession it represents.
The practical consequence for a practice owner is simple. Once your practice is live, if a member of Tilcao staff has read a call from your practice, you can find out that it happened, when, and which account did it.
Where is the data hosted, and how long is it kept?
Partly in the EU, and this page says which part. Tilcao itself runs on Google Cloud in Belgium, and its database runs on Supabase in Ireland. The voice line does not stay in the EU. Retell handles the call, the speech recognition and the voice, and it processes in the United States. It has no EU region. The language model comes from Anthropic and the phone numbers from Twilio, both American companies. WhatsApp messages pass through Meta’s data centres. For a practice’s own number we switch on Meta’s storage in the EU, although Meta may still handle a message elsewhere for up to an hour.
Before a practice’s first real patient call, every transfer out of the EEA is covered by the European Commission’s standard contractual clauses or by the EU-US Data Privacy Framework. No Belgian law obliges a private practice to keep its data in Belgium or in the EU. The GDPR does require every transfer out of the EEA to be named and covered. That is what the annex to the processing agreement is for. It names every sub-processor, what it does and where it processes, and each change gets a dated entry.
Retention runs on more than one clock, and the call does not inherit the clock of the clinical file. A dental dossier is kept for years because the law and the care require it. A recording of somebody asking for a Thursday morning is not that, and treating the two the same way is how a practice ends up holding audio it has no reason to hold.
This page prints no retention number, on purpose. The periods are set with each practice and written into its agreement as days and months, because the right period depends on that practice. What holds for every practice is the shape: a clause that says “as long as necessary” is not a retention clause.
- Call audio: the shortest clock of anything on this list, and the first thing deleted.
- Transcript: kept longer than the audio, because it is what an access request gets answered from.
- Structured summary and appointment fields: kept while the practice needs the operational record.
- Audit record: kept as the accountability evidence under Article 5(2) GDPR. It records that a deletion happened without keeping what was deleted.
- The clinical dossier: the practice’s own retention rules, in the practice’s own system. Nothing on this list touches it.
Who can see what, and what does the audit trail actually record?
Today only the Tilcao team can open the dashboards. Before a practice goes live, access becomes per account and per role, and the practice decides who gets which. On the caller side the rule is stricter than most front desks apply by habit: two matching identifiers before anything is read back, the family name or the phone number on file, plus the date of birth. Before that is satisfied, Tilcao does not volunteer the practitioner’s name, the reason for an appointment, any other appointment, or a balance. From a practice’s first real patient call, requests about someone else are refused, with one exception, a parent or guardian asking about a minor.
Accountability under Article 5(2) of the GDPR only means something if it was recorded at the time. Today every action the assistant takes is recorded with the call: each search, identity check, booking, move, cancellation and hand-over, with what went in and what came back. From a practice’s first real patient call, every read of patient data, by the assistant or by a person, is also logged with who asked, the outcome of the verification and the fields that were disclosed. The booking outcome in the summary is derived from what was actually written to the diary, not from what the agent said it would do, so the record and the diary cannot drift apart.
This is what one record looks like. It is worth more than a paragraph of assurances, because a practice can check it against its own diary.
| Field | What the record holds |
|---|---|
| Call | 2026-09-17 19:42, inbound, 3 min 11 s, handled by the Receptionist role |
| Disclosure | AI and recording notice given in the opening line, in Dutch |
| Identification | Two identifiers matched, surname and date of birth. File 2041 |
| Disclosed | Date and time of the next appointment. Practitioner name withheld until the match |
| Action | Appointment moved, Thursday 10:30 to Friday 11:00, type check-up |
| Written to | The practice diary. The outcome above was read back from the diary |
| Escalation | None. No red flag in the call and no request for a person |
| Read since | Two reads, both by practice staff accounts, each with a timestamp |
How do we pause it, and what happens to a request for erasure?
The practice can take the whole line back at any moment by switching its own call forwarding off. From a practice’s first real patient call, each workflow can also be paused on its own, and a paused workflow does not run. A blocked action does not happen at all rather than happening and being logged as a problem afterwards. Change a rule and the behaviour changes with it, with no notice period. Nothing about stopping is designed to be difficult, because a control you cannot use in the middle of a bad afternoon is not a control.
An erasure request goes to the practice, because the practice is the controller and the patient’s relationship is with the practice. From a practice’s first real patient call, erasure works like this: the practice instructs Tilcao, and the audio, the transcript and the structured summary tied to that patient are deleted. The audit trail keeps the fact that a deletion happened, with its date and who asked for it, and not the content that was deleted. Erasure does not reach a record the practice is legally required to keep: the clinical dossier and the accounting trail live under their own rules, in the practice’s own systems, and no request to Tilcao changes that.
A patient may also simply ask what was recorded. The practice answers, as controller, and the GDPR gives it one month, extendable by two months for a genuinely complex request. Tilcao’s job is to put the material in the practice’s hands well inside that window. Belgian patients have a second route to the same thing: the Patient Rights Act of 22 August 2002, substantially amended by the Act of 6 February 2024 and in force since 4 March 2024, strengthened comprehensible information, transparency and digital access to the file.
Practices are welcome to lift this section into their own privacy notice and link to this page from it, which is part of why it is written the way it is.
- Access to the recording, the transcript and the summary of a call.
- Rectification of anything recorded wrongly, including a misheard name or date.
- Erasure, within the limits the clinical and accounting retention rules set.
- Objection to the processing, which in practice means asking for a human line.
- A complaint to the Gegevensbeschermingsautoriteit / Autorité de protection des données, the Belgian data protection authority, at Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels. It costs nothing to file.
What does the EU AI Act require, and what does Tilcao not claim?
Article 50 of the EU AI Act has applied since 2 August 2026. It requires that a person be informed they are interacting with an AI system, unless that would be obvious to a reasonably well-informed, observant and circumspect person. It applies whether or not the system is high-risk, and national market surveillance authorities can enforce it from that date. Tilcao gives the disclosure whether or not it would be obvious, in the opening line, right after the greeting.
An appointment-booking agent is not a high-risk AI system, and this page will not pretend otherwise in either direction. Tilcao has not done a high-risk conformity assessment, does not need one for this use, and claims no compliance status of any kind. Article 50 is not a certificate to display. It is something a system either does on every single call or does not do, and the way to check it is to ring the demo number and listen to the opening line.
This is the opening line of the demo practice on this site, in the three languages Tilcao answers in. A practice can change the wording to fit how it speaks to its patients. It cannot remove the disclosure.
- English: Dental practice, hello, Sofie speaking. I’m the practice’s AI assistant and this call is recorded. You can ask for a colleague at any time. How can I help you?
- Dutch: Tandartspraktijk, goedendag, u spreekt met Sofie. Ik ben de AI-assistente van de praktijk en dit gesprek wordt opgenomen. U kunt op elk moment naar een collega vragen. Waarmee kan ik u helpen?
- French: Cabinet dentaire, bonjour, Sofie à l’appareil. Je suis l’assistante IA du cabinet et cet appel est enregistré. Vous pouvez demander une collègue à tout moment. Comment puis-je vous aider ?
| Not held, not claimed | What is true instead |
|---|---|
| ISO 27001 | Tilcao does not hold the certification and does not claim it |
| SOC 2 | No report exists. There is nothing to send you |
| NIS2 compliance status | No status is claimed under NIS2 |
| A completed DPIA | None has been completed. Where the practice needs one as controller, the assessment is the controller’s to make, and Tilcao supplies the detail it asks for |
| A high-risk conformity assessment under the AI Act | Not done, and not required for an appointment-booking agent |
| An eHealth certificate or a place on the MyCareNet list | Neither is held, and neither is needed to write an appointment into a diary |
| An endorsement from a Belgian professional body | There is no Order of Dentists in Belgium, and no association has published a position on AI at the front desk |
Questions practices ask
Is an AI receptionist GDPR compliant for a Belgian dental practice?
It can be, and compliance is an arrangement between the practice and the supplier rather than a property of the software. A dental call is special-category health data under Article 9 of the GDPR, so the practice processes it as controller on Article 9(2)(h) for the provision of health care, read with Article 6, and the supplier processes it as processor under a written Article 28 agreement. No vendor can be GDPR compliant on your behalf, and any vendor claiming to be should be asked to show you the agreement instead.
Do we need a verwerkersovereenkomst or contrat de sous-traitance with Tilcao?
Yes, and it has to be signed before the first real patient call, not once calls are already running. It is the Article 28 processing agreement, and it sets out the instructions Tilcao may act on, the retention period per data type as a number, the security measures, how a breach is notified, how access and erasure requests are handled, and what happens to the data at the end. Its annex names every sub-processor and the region it processes in, so the list can be checked rather than believed.
Are patient calls recorded, and do callers know?
Calls are recorded, and the caller is told in the opening line, together with the fact that they are speaking to an AI. The practice’s wording of that line can also say why the call is recorded. The purpose and the retention period go in the practice’s privacy notice, the period once it is set in the processing agreement. Belgian law does not forbid recording a conversation you are party to, but Article 344 of the Belgian Criminal Code (formerly Article 314bis §2) punishes using such a recording with intent to harm, and telecom rules and the GDPR both require the notice in advance. Any caller who would rather speak to a person says so and is handed over, because a disclosure with no alternative is not a choice.
Does a recorded call breach beroepsgeheim or secret professionnel?
Not if the people who can hear it are bound the way the practice is bound. Article 352 of the Belgian Criminal Code (formerly Article 458) applies independently of the GDPR, it is criminal rather than administrative, and no contract signs it away. Article 9(3) of the GDPR points at the same requirement: the processing has to happen under the responsibility of someone bound by professional secrecy or an equivalent duty. Inside Tilcao that means only the people who need a transcript can read one, and from a practice’s first real patient call each of them has signed a written confidentiality undertaking mirroring medical secrecy and every read is logged against a named account.
Where is our patients’ data hosted?
Not all of it in the EU. Tilcao runs on Google Cloud in Belgium and keeps its database at Supabase in Ireland. Calls go through Retell, which processes in the United States. Anthropic, for the language model, and Twilio, for the phone numbers, are American companies too, and WhatsApp runs through Meta’s data centres. Before a practice’s first real patient call, those transfers are covered by standard contractual clauses or the EU-US Data Privacy Framework. The annex to the processing agreement names every sub-processor and where it processes.
How long are recordings and transcripts kept?
On a shorter clock than the clinical file, and on more than one clock. The raw audio is the first thing deleted, the transcript lives longer because it is what an access request is answered from, and the structured summary stays while the practice needs the operational record. This page prints no number because the periods are agreed with each practice and written into its agreement as days and months. A retention clause that says only “as long as necessary” is not a retention clause.
Can a patient ask us to delete a recorded call?
Yes, and the request goes to the practice, because the practice is the controller. From a practice’s first real patient call, erasure works like this: the practice instructs Tilcao, and the audio, transcript and structured summary for that patient are deleted, while the audit trail keeps the fact of the deletion and not its content. Erasure does not reach records the law requires the practice to keep: the clinical dossier and the accounting trail sit in the practice’s own systems under their own retention rules.
Is Tilcao ISO 27001 or SOC 2 certified?
No. Tilcao holds no ISO 27001 certification, has no SOC 2 report, claims no NIS2 status, has not completed a data protection impact assessment and has not done a high-risk conformity assessment under the AI Act, which an appointment-booking agent does not require. It holds no eHealth certificate and is not on the MyCareNet approved-software list, neither of which is needed to write an appointment into a diary. Saying so plainly is more useful than a badge that would not survive a question.
Who do we complain to if something goes wrong with our patients’ data?
The Belgian supervisory authority is the Gegevensbeschermingsautoriteit / Autorité de protection des données, at Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, and a complaint there costs nothing. The practice, as controller, is also the first address for a patient, which is why the processing agreement sets out how quickly Tilcao has to hand over what the practice needs to answer. A personal data breach has its own clock and its own notification route, and both belong in the agreement rather than in a support ticket.